How Does Puffer Finance Work?
A restaking protocol that lets you earn extra yield by putting your ETH to work across multiple blockchain services at once. It holds $800M in deposits. Its C grade comes from relying on Intel chip security to protect validators -- if that chip security fails, each validator has only 1-2 ETH of insurance covering a potential 30 ETH loss.
TVL
$46M
Sector
Restaking
Risk Grade
C
Value Grade
D
Core Mechanisms
Security/TEE
NovelSecure-Signer TEE for anti-slashing protection
Uses Intel SGX trusted execution environment to prevent validators from signing slashable messages; novel hardware dependency with TEE trust assumption.
Staking/Validator-Tickets
NovelValidator Tickets for node operator bonding
Operators purchase time-limited tickets to run validators, replacing traditional bond requirements; untested economic model.
L2/Based-Rollup
NovelBased rollup with preconfirmation sequencing
UniFi based rollup uses Puffer validators for preconfirmation; creates dual obligation between staking and sequencing duties.
Oracle/Guardian
Novel7-of-8 Guardian multisig oracle for exchange rates
Custom Guardian committee oracle reports pufETH exchange rates; liveness failure blocks all withdrawals.
Restaking/LRT
pufETH liquid restaking token
Standard LRT representing restaked ETH positions with integrated anti-slashing via Secure-Signer.
How the Pieces Interact
TEE compromise or failure removes anti-slashing protection while bond remains minimal, leaving up to 30 ETH residual risk per validator uncovered.
Validators simultaneously committed to preconf and AVS can be slashed on both obligations from a single correlated failure.
Guardian liveness failure freezes all pufETH redemptions; 7-of-8 threshold means 2 Guardian failures halt the system.
What Could Go Wrong
- TEE failure leaves 30 ETH residual risk per validator
- Double slashing from preconf + AVS simultaneous obligations
- Guardian oracle liveness blocks withdrawals
TEE Failure Mass Slashing Event
ElevatedTrigger: Intel SGX vulnerability or TEE attestation bypass affects >20% of Puffer validators simultaneously, removing anti-slashing protection while bonds remain at 1-2 ETH
- 1.Intel discloses SGX vulnerability affecting Secure-Signer TEE attestation — Anti-slashing protection becomes unreliable; validators can sign slashable messages
- 2.Attackers exploit TEE bypass to trigger slashing events on unprotected validators — Validators lose 30 ETH each in slashing penalties with only 1-2 ETH bond coverage
- 3.28-29 ETH per validator in uncovered slashing losses socialized across pufETH holders — pufETH exchange rate drops sharply as protocol absorbs massive slashing losses
- 4.pufETH holders rush to redeem, but Guardian oracle struggles with rapidly changing exchange rates — Redemption queue grows; pufETH trades at 5-15% discount on secondary markets
- 5.Guardian liveness pressure increases as oracle must constantly update declining rates — If 2+ Guardians fail under pressure, all withdrawals freeze entirely
Risk Profile at a Glance
Overall: C (46/100)
Lower score = safer